--- title: 'How to check a proxy for DNS and WebRTC leaks' url: 'https://blog.zl0y.team/en/blog/dns-webrtc-leak-test' markdown: 'https://blog.zl0y.team/en/blog/dns-webrtc-leak-test.md' lang: en date: '2026-08-24' description: 'Как можно определить ваше реальное местоположение, даже если вы используете прокси и VPN.' taxonomy: tag: - DNS --- ![Hero Image](https://blog.zl0y.team/user/themes/my-typhoon/images/headers/sea-and-sky.jpg) 24th Aug 2026 # How to check a proxy for DNS and WebRTC leaks [ DNS ](https://blog.zl0y.team/tag:DNS#blog_list) A proxy does not guarantee that a user's real IP address will remain hidden. If a protocol with remote resolving, such as SOCKS5h, is not used, DNS queries via proxy are performed locally on the user's device rather than on the proxy server side. In turn, WebRTC technology operates over the UDP protocol and requests addresses directly from network interfaces, which allows it to establish P2P connections bypassing classic TCP proxies, enabling websites to see your public IP. Today we will talk again about leaks that have become an all too familiar problem: DNS and WebRTC. Even expensive and private proxies, as well as VPNs, can leak your real IP to websites. In this article, we will break down how both types of leaks occur, as well as how to test your connection. And protect it. #### Table of Contents - [How DNS leaks occur](#how-dns-leaks-occur) - [How WebRTC leaks work](#how-webrtc-leaks-work) - [Services for testing DNS and WebRTC leaks](#services-for-testing-dns-) - [Checking for DNS leaks](#checking-for-dns-leaks) - [Checking for WebRTC leaks](#checking-for-webrtc-leaks) - [Zloy Detect — all in one](#zloy-detect-all-in-one) - [ZloyRouter as protection against proxy detection](#zloyrouter-as-protection-) - [Conclusion](#conclusion) ## How DNS leaks occur DNS converts a domain name, for example `example.com`, into an IP address. A leak occurs when the browser or OS performs DNS resolution locally through your regular DNS resolver instead of passing this process to the proxy server. A brief history excursion: DNS was invented by analogy with a phone book, where it was enough to remember only the name of the person you wanted to call. You enter the name, and the phone number is found. It's the same with DNS: you enter a website address, and the browser automatically finds its IP. **But where does it look for it? And most importantly — how?** This process is called DNS resolving. Essentially, in simplified form, the scheme looks like this: ![dns_resolving_diagram](https://blog.zl0y.team/user/pages/03.blog/dns-webrtc-leak-test/resolv_giagram.png) But what happens when intermediaries in the form of proxies and VPNs appear in the `user's browser --> website` connection scheme? How is DNS resolving carried out when traffic moves like this: `user's browser --> proxy --> website`? And what if it's `user's browser --> entry proxy server --> exit proxy server --> website`? It all depends on the underlying technology of your proxies and VPNs. We will look exclusively at proxies: unlike VPNs, they do not create an encrypted tunnel for all device traffic and are therefore more susceptible to DNS leaks. If you want a separate breakdown of VPNs, let us know in the comments, and we will prepare material based on your requests. Out of all proxy standards, SOCKS5h is optimal for work. It is available for purchase, unlike rarer types. And the price is quite reasonable nowadays. In general, if your seller doesn't have it — walk away and keep looking. Tip *We do not collaborate with proxy sellers or any other service providers to remain as unbiased as possible and provide an objective assessment of the quality of their work.* To understand why specifically SOCKS5h, let's look at how a DNS leak works. To detect a leak, a website forces your browser to query a unique random subdomain on its own domain (e.g., `xyz123.example.com`). Since this subdomain is not in the cache, the query goes directly to the authoritative DNS server hosting this service's domain. This server records the IP address of the resolver that requested the address. If the received IP belongs to your ISP or your real region rather than the proxy server, a leak is confirmed. The absence of leaks depends directly on the protocol and client settings. For example, standard SOCKS5 resolves names on the client side by default, while SOCKS5h is guaranteed to pass the domain name to the proxy server. ## How WebRTC leaks work WebRTC allows two browsers to communicate directly with each other, for example, during a video call, without routing traffic through third-party servers. For browsers to find each other on the network, the technology collects all available routes to you (ICE candidates): your local IP address, your public IP address (via a STUN server), and the address of a relay server (TURN) if a direct connection is blocked. Note The main problem from an anonymity standpoint is that a website can request and discover these network addresses via JavaScript even before you start the call itself. ![](https://blog.zl0y.team/user/pages/03.blog/dns-webrtc-leak-test/webRTC-leak.png) The leak occurs because the WebRTC ICE agent accesses the OS network interfaces directly to poll all possible network routes, bypassing standard browser proxy settings. As a result, the website can get the real public IPv4 or IPv6 address, even when regular web traffic is routed through a proxy. In addition to determining the public address, WebRTC can extract the **local IP address** of your device on the subnet (e.g., `192.168.X.X`). Collecting this data allows websites and anti-fraud systems to build a more accurate digital fingerprint of the device and analyze its network environment. In other words, a hypothetical "Amazon" can scan your local network through the browser and see your local IP. [![CheckYourPrivacy](https://blog.zl0y.team/user/pages/03.blog/dns-webrtc-leak-test/CheckYourPrivacy_banner.jpg)](https://dnsdetect.zl0y.team?utm_source=blog&utm_medium=referall&utm_campaign=dns-webrtc-leak-test&utm_content=CheckYourPrivacy_banner) You can learn more about how websites scan the local network and check internal IP addresses in [this article](https://telegra.ph/ZloyRouter--Podseti-04-13). ## Services for testing DNS and WebRTC leaks To test for DNS and WebRTC leaks, a number of specialized online tools are used: - **dnsdetect.zl0y.team** — an "all-in-one" tool that supports checking for DNS and WebRTC leaks on a single page. In addition, it shows the percentage probability that you are using a VPN or Proxy. - **dnsleaktest.com** — a specialized tool for testing DNS and WebRTC leaks. - **browserleaks.com** — a site with a large set of tools for checking the security and privacy of your browser. - **2ip.ru** — a popular service for a quick check of your current IP address. - **addr.tools** — a minimalist service for a quick check of IP and DNS leaks both through the browser and from the terminal (`curl addr.tools`). - **ipleak.net** — a universal platform that brings together tests for IP, DNS, WebRTC, Torrent traffic, as well as system info and request headers onto a single page. In this article, we will use the **DNSLeakTest** service to check for DNS leaks, **BrowserLeaks** to check for WebRTC leaks, **2ip.ru** to get an IP address, as well as our product Zloy Detect for an instant check of all the above in one window. ## Checking for DNS leaks To check for a DNS leak, you need to: 1. Go to https://dnsleaktest.com; 2. Click the **"Extended test"** button; 3. Wait for the test to complete. ![](https://blog.zl0y.team/user/pages/03.blog/dns-webrtc-leak-test/dnsleaktest.png) Once the test is complete, the service will show the DNS servers that processed the test queries. If only servers corresponding to public DNS servers (Google, Cloudflare, etc.) or the DNS servers of the data center where the proxy is located are displayed, there are no signs of a leak within the scope of this test. There is also an ECS (EDNS Client Subnet) mechanism that can transmit your IP partially or completely to DNS servers. You can learn more about ECS in [our article](https://telegra.ph/Kak-DNS-slivaet-vash-realnyj-IP-adres-12-17). However, keep in mind that using public DNS servers can give you additional "Risk Points" in an anti-fraud system. The presence of DNS servers from your ISP or home router clearly indicates a DNS leak. ![](https://blog.zl0y.team/user/pages/03.blog/dns-webrtc-leak-test/dnsleaktest_result.png) ## Checking for WebRTC leaks 1. Find out your public IP address with your VPN and proxy disabled, for example on https://2ip.ru (or with the `curl 2ip.ru` command), and save the result; 2. Go to https://browserleaks.com/webrtc; 3. Compare the IP addresses shown by the service with the saved address and the expected proxy or VPN address. ![](https://blog.zl0y.team/user/pages/03.blog/dns-webrtc-leak-test/webRTC_leak_ip.png) If the service shows your public IP address instead of the proxy or VPN one, this indicates a potential WebRTC leak. A mismatch between the **IPv4 Address** and **Public IP Address** fields proves an IP address leak, as the browser exposed the real IP 133.7.1.33. ![](https://blog.zl0y.team/user/pages/03.blog/dns-webrtc-leak-test/webRTC_leak_result.png) ## Zloy Detect — all in one Important [Zloy Detect](https://dnsdetect.zl0y.team?utm_source=blog&utm_medium=referall&utm_campaign=dns-webrtc-leak-test&utm_content=ZloyDetect_AllInOne) combines DNS and WebRTC checks on a single page. Instead of using multiple services, you get a comprehensive picture of leaks in a single interface. The main advantage of the tool is its **ML-based Nativeness Score algorithm (DNS Nativeness Score)**. It analyzes your IP and DNS parameters, matches them against a pattern database, and outputs the probability of Proxy or VPN usage. As a nice bonus, it has a sleek design in the style of a classic terminal. ![](https://blog.zl0y.team/user/pages/03.blog/dns-webrtc-leak-test/ZloyDetect_result_proxy.png) The site will do everything anti-fraud systems would want to do to find out your IP address or understand whether you are using a Proxy/VPN. As can be seen in the screenshot, there is a high probability (73%) that a proxy is being used (which is true), which would successfully trigger the anti-fraud systems of third-party services. This is mainly due to a mismatch between the geo parameters of your IP and the DNS server to which the DNS queries are sent. Another reason could be the lack of a UDP connection. Despite using a proxy, Zloy Detect showed us our IP address, which directly indicates a DNS or WebRTC leak as well. ## ZloyRouter as protection against proxy detection [ZloyRouter](https://docs.zl0y.team?utm_source=blog&utm_medium=referall&utm_campaign=dns-webrtc-leak-test&utm_content=ZloyRouter1) is a hardware gateway. Browser-based WebRTC and DNS leaks occur because the OS and browser query network interfaces directly, bypassing a regular TCP proxy. ZloyRouter intercepts and isolates these requests before they even leave the device at the network level. Note However, if you pass traffic through the **ZloyRouter** hardware gateway using the exact same proxy, the picture changes radically. ZloyRouter eliminates leaks at the network level. You can learn more about how to install and use ZloyRouter in [our documentation](https://docs.zl0y.team?utm_source=blog&utm_medium=referall&utm_campaign=dns-webrtc-leak-test&utm_content=ZloyRouter2). ![](https://blog.zl0y.team/user/pages/03.blog/dns-webrtc-leak-test/ZloyDetect_result_clean.png) As we can see, our identity remained undisclosed because ZloyRouter itself closed all potential leaks through DNS and WebRTC, matched the correct DNS using [VDNS](https://telegra.ph/VDNS--Zatykaem-DNS-dyry-i-letaem-bystree-04-11) technology, and the probability of proxy usage became much lower, allowing the "Clean" connection metric to rise to 77%. However, it's worth noting that the results may vary depending on the different proxies you use with ZloyRouter. ## Conclusion DNS and WebRTC leaks can strip you of your anonymity. If tests detect your ISP's DNS servers or your real IP address, a leak has occurred. To avoid DNS leaks, you need to use SOCKS5h so that DNS queries are resolved on the proxy server side, or force the configuration of third-party DNS servers at the operating system level. Keep in mind that configuring a proxy only in the browser does not guarantee full protection: the OS itself can continue to send DNS queries bypassing the browser via the system resolver. To avoid WebRTC leaks, the problem is solved by completely disabling WebRTC in the browser settings, for example, via `about:config` in Firefox, or by using specialized extensions. However, bear in mind that completely disabling WebRTC in the browser can serve as a red flag for anti-fraud systems. As an alternative, you can use [**ZloyRouter**](https://docs.zl0y.team?utm_source=blog&utm_medium=referall&utm_campaign=dns-webrtc-leak-test&utm_content=ZloyRouter3), which will take care of your privacy for you. You can find more interesting articles in our [Telegram channel](https://t.me/+FyMEo49IHh80NDNi). Meanwhile, we will continue doing everything we can to keep you anonymous and private online. Stay tuned! [ Previous Post](https://blog.zl0y.team/en/blog/dns-hijacking) [Next Post ](https://blog.zl0y.team/en/blog/socks5-vs-socks5h) #### Other Related Posts: [ ![DNS hijacking: How Roskomnadzor, other countries' regulators, and proxy services themselves control your DNS requests](https://blog.zl0y.team/user/pages/03.blog/dns-hijacking/DNS-hijacking.webp) ](https://blog.zl0y.team/en/blog/dns-hijacking) [ DNS ](https://blog.zl0y.team/tag:DNS#blog_list) ### DNS hijacking: How Roskomnadzor, other countries' regulators, and proxy services themselves control your DNS requests [DNS hijacking: How Roskomnadzor, other countries' regulators, and proxy service…](https://blog.zl0y.team/en/blog/dns-hijacking) The material consists of two parts, and the second is more important than the first. In the first part, we break down how the state intercepts DNS queries: detailing the mechanics of Roskomnadzor (*TSPU, NSDI, the story of the one-hour block of 1.1.1.1 and 8.8.8.8, the YouTube case in February 2026*)... 24th Aug 2026 [ ![DNS Nativeness Checker Under the Microscope: How Anti-Fraud Detects Proxies Using 9Proxy and Nsocks as Examples](https://blog.zl0y.team/user/pages/03.blog/dns_nativeness_checker/Pasted%20image%2020260624192725.png) ](https://blog.zl0y.team/en/blog/dns_nativeness_checker) ### DNS Nativeness Checker Under the Microscope: How Anti-Fraud Detects Proxies Using 9Proxy and Nsocks as Examples [DNS Nativeness Checker Under the Microscope: How Anti-Fraud Detects Proxies Usi…](https://blog.zl0y.team/en/blog/dns_nativeness_checker) The nativeness of a proxy for anti-fraud (AF) systems is influenced by many parameters. Currently, the database of our [nativeness check service](https://dnsdetect.zl0y.team?utm_source=blog&utm_medium=article&utm_campaign=native_proxy_check&utm_content=) contains 170 conditions and 2.5 million rules based on the matrix of these conditions — and each has its own weight in deciding who is in front of us: a r... 17th Sep 2026 - [blog](https://blog.zl0y.team/en) - EN - [Русский](https://blog.zl0y.team/ru/blog/dns-webrtc-leak-test) --- ## Navigation - Parent: [blog](https://blog.zl0y.team/en/index.md) - Previous: [How does SOCKS5 differ from SOCKS5h - which is better for anonymity?](https://blog.zl0y.team/en/blog/socks5-vs-socks5h.md) - Next: [DNS hijacking: How Roskomnadzor, other countries' regulators, and proxy services themselves control your DNS requests](https://blog.zl0y.team/en/blog/dns-hijacking.md)